Advanced Management and Configuration

Frogbot offers two layers of configuration, listed from highest to lowest priority:

1. Environment variables
2. Frogbot Configuration under Administration > Xray Settings > Indexed Resources > Git Repositories tab.

Frogbot Configuration

Frogbot Configuration allows you to manage Frogbot settings for all your Git repositories from the JFrog Platform UI, without modifying repository files or CI pipelines.

Accessing Frogbot Configuration

1. Navigate to Administration > Xray Settings > Indexed Resources > Git Repositories.
2. The table displays your connected git servers, folders, and repositories.
3. Click on any entry to open the Frogbot Configuration drawer.

On a Git repository, the drawer includes a Workspace list. Select a workspace before you apply scan, auto-fix, or pull request settings. Click Manage Workspaces in that list, or use Manage Workspaces in the repository row actions, to add, rename, or delete workspaces. You can't rename or delete the default workspace. For the full procedure, see Manage Frogbot Workspaces.

Configuration Hierarchy

Settings follow your SCM structure and are inherited downward:

Git Server (e.g., github.com/my-org)
  └── Folder (e.g., my-org/backend)
       └── Repository (e.g., my-org/backend/api-service)

• Server-level settings apply to all folders and repositories on that server.
• Folder-level settings override server settings and apply to all contents within.
• Repository-level settings override folder and server settings.

Each entity shows a configuration status:

Batch Configuration

To apply the same configuration to multiple entities at once:

1. Select multiple servers, folders, or repositories in the table.
2. Click Batch Configure.
3. Configure settings in the drawer — they will be applied to all selected entities.

Configuration Tabs

The configuration drawer has three tabs:

Scans Configuration

Controls which scanners are enabled and their settings:

Additional settings:

• Differential Scan (repository-level only, SAST) — When enabled, scans only the changes introduced in commits or pull requests rather than the entire codebase. This reduces scan time and noise by focusing results on newly introduced code.
• Snippet Detection (repository-level only) — detect copied open-source code snippets
• Global Exclude Paths — patterns to exclude across all scanners
• Global Include Paths — limit scanning to specific paths
• Advanced Settings:
  • Fail on scan error — fail the CI job if any scanner errors
  • Scanner download source — JFrog Releases (default) or air-gapped Artifactory repository

Auto-PR

Frogbot Auto-PR opens fix pull requests automatically during commit scans. To open a fix pull request on demand from an Xray scan result instead, see Create Fix Pull Requests with Auto-PR.

The following settings control automatic fix pull request behavior:

Available template variables:

PR Decorations

Controls how Frogbot comments on pull requests:

Environment Variables Reference

Connection

Policy Enforcement

Results Upload

SAST

Debugging

Air-Gapped Environments

By default, Frogbot downloads scanner executables from https://releases.jfrog.io. For air-gapped environments:

1. Create a Remote Repository in Artifactory:

   • Type: Generic
   • URL: https://releases.jfrog.io
   • Uncheck Store Artifacts Locally

2. Under Administration > Xray Settings > Indexed Resources, select the Git Repositories tab.

3. From the three-dot menu, select Configure and set the Scanner download source to Air-gapped repository in the Advanced Settings section and provide the repository name.